{"id":"1dd05363-104e-4b4a-b963-196a534b03a1","title":"Potential Suspicious Mofcomp Execution","description":"Detects execution of the \"mofcomp\" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline.\nThe \"mofcomp\" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.\nAttackers abuse this utility to install malicious MOF scripts\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-12","modified":"2023-04-11","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/","https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml","https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp"],"source_path":"rules/windows/process_creation/proc_creation_win_mofcomp_execution.yml","source_sha256":"bd46719d891e2496bbc5f2b416ee7ba9659ac2026aa842a1b9d12e5c05a45046","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mofcomp_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Suspicious Mofcomp Execution\nid: 1dd05363-104e-4b4a-b963-196a534b03a1\nstatus: test\ndescription: |\n    Detects execution of the \"mofcomp\" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline.\n    The \"mofcomp\" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.\n    Attackers abuse this utility to install malicious MOF scripts\nreferences:\n    - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/\n    - https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml\n    - https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-12\nmodified: 2023-04-11\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\mofcomp.exe'\n        - OriginalFileName: 'mofcomp.exe'\n    selection_case:\n        - ParentImage|endswith:\n              - '\\cmd.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\wsl.exe'\n              - '\\wscript.exe'\n              - '\\cscript.exe'\n        - CommandLine|contains:\n              - '\\AppData\\Local\\Temp'\n              - '\\Users\\Public\\'\n              - '\\WINDOWS\\Temp\\'\n              - '%temp%'\n              - '%tmp%'\n              - '%appdata%'\n    filter_main_wmiprvse:\n        ParentImage: 'C:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n        CommandLine|contains: 'C:\\Windows\\TEMP\\'\n        CommandLine|endswith: '.mof'\n    filter_optional_null_parent:\n        # Sometimes the parent information isn't available from the Microsoft-Windows-Security-Auditing provider.\n        CommandLine|contains: 'C:\\Windows\\TEMP\\'\n        CommandLine|endswith: '.mof'\n    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/1dd05363-104e-4b4a-b963-196a534b03a1.json","kind":"sigma"}